Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.3

Google Settings app allows overlay attack to gain notification access

CVE-2021-0331 · published 5 years ago
Summary

The Android Settings application can be tricked by another app to place a screen overlay when the notification access screen opens, letting the malicious app obtain notification permissions and increase its privileges. This requires a user to interact with the screen, but it can give the attacker more control over the device. Keep your device updated with the latest Google releases and avoid installing apps that request permission to draw over other apps unless they are trusted.

What to do
  • Update google platform/packages/apps/settings to version 8.0:2021-02-01.
  • Update google platform/packages/apps/settings to version 8.1:2021-02-01.
  • Update google platform/packages/apps/settings to version 9:2021-02-01.
  • Update google platform/packages/apps/settings to version 10:2021-02-01.
  • Update google platform/packages/apps/settings to version 11:2021-02-01.
Affected software
Ecosystem VendorProductAffected versions
Android google platform/packages/apps/settings >= 8.0:0, < 8.0:2021-02-01
>= 8.1:0, < 8.1:2021-02-01
>= 9:0, < 9:2021-02-01
>= 10:0, < 10:2021-02-01
>= 11:0, < 11:2021-02-01
Fix: upgrade to 8.0:2021-02-01
– google android 8.1
9.0
10.0
11.0
cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*
Original advisory text
In onCreate of NotificationAccessConfirmationActivity.java, there is a possible overlay attack due to an insecure default value. This could lead to local escalation of privilege and notification ac...
In onCreate of NotificationAccessConfirmationActivity.java, there is a possible overlay attack due to an insecure default value. This could lead to local escalation of privilege and notification access with User execution privileges needed. User interaction is needed for exploitation.
References
Severity
7.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-1021Improper Restriction of Rendered UI Layers or Frames
Timeline
Published1 Feb 2021
Updated3 Nov 2026
First seen8 Sep 2026
Sources
ASB-A-170731783 · OSV
CVE-2021-0331 · NVD
Track software like this
Free during beta